DEIN Finance

ERC-20 Permit is a modification of the standard ERC-20 token that allows users to delegate their spending rights to other addresses without having to send the tokens themselves or use ether to pay for gas for transactions. It uses the nonces mapping for replay protection. Once a signature is verified and approved, the nonce increases, invalidating the same signature being replayed.When the user transaction is in the mempool, an attacker can take this signature, call the token.permit function on the token directly and make the user’s transaction fail whenever it gets mined, causing a Denial of Service.

The deinStaking.restakeReward() function allows users to restake rewards in a new position or into an existing one. Restaking rewards in a exisiting position applies the multiplier from that staking position but without locking the tokens for that time. This way, users may obtain more rewards than expected, as they could obtain higher multipliers for less staking time. instead of staking in a new position.

Fee-on-transfer tokens are ERC-20 tokens that deduct a fee whenever they are transferred. DEIN protocol uses USDT as stablecoin but it does not implement controls to cover this fee on transfer token if fee is set. This may lead to accounting errors that will break the protocol.

if the DEIN/ETH pool has low liquidity, it is easier for a malicious user to manipulate the price with less capital.This user could place a large trade to push the price in one direction and then reverse it before TWAP correctly records the average.